ASIS-PSP Physical Security Professional (PSP) Exam Questions and Answers

The correct answer is B. Protection in depth.

In a physical protection system, protection in depth means placing multiple protective measures or layers between the adversary and the protected asset. The adversary must defeat or bypass these protective measures in sequence before reaching the target. This may include barriers, locks, access control points, intrusion detection systems, surveillance, delay measures, and response procedures.

This concept is consistent with physical protection system design principles, where protection in depth requires an adversary to avoid or defeat multiple protective devices one after another.

The other options are not the best answer:

A. Redundant protection means using backup or duplicate protective measures, but it does not specifically mean sequential layers.

C. Balanced protection means protection should be consistent across all possible adversary paths, so no weak path is left exposed.

D. Probability of detection refers to the likelihood that an adversary action will be detected.

Therefore, the correct PSP-relevant answer is B. Protection in depth.

Integrity and lie detection tests fall into multiple categories, including:

Polygraph: Measures physiological responses to assess truthfulness.

Psychological Stress Evaluator (PSE): Analyzes voice stress to detect deception.

Personal Security Inventory: A written assessment designed to evaluate honesty and attitudes toward theft or other misconduct.

Each of these tools can play a role in assessing trustworthiness, particularly in high-risk or sensitive positions, and are often part of pre-employment or internal investigation procedures (where legally permissible).

Physical barriers are designed to defend against three main penetration techniques:

Stealth: Unauthorized entry without detection.

Deception: Gaining access through trickery or impersonation.

Force: Physical breaching of barriers or using tools or vehicles to gain entry.

Security systems are designed to detect and delay each of these methods effectively.

A and B mix categories inaccurately.

C (Vehicle) is a tool/method of force, not a category on its own.

Security consultants are often retained to provide strategic input on staffing needs, policy design, and technology integration. Their advice helps organizations make informed decisions regarding the deployment of personnel, the structure of policies, and the selection of physical and electronic security systems.

The correct answer is C. Equipment performance testing.

In PSP physical security implementation, testing is used to verify that installed security equipment and systems actually perform according to required functional and performance objectives. The ASIS PSP Body of Knowledge includes functional requirements, performance requirements, success metrics, commissioning, and final acceptance testing as part of physical security system design and implementation.

Equipment performance testing is the specific type of testing used to determine whether equipment or a system is functional, has adequate sensitivity, and meets its design and performance objectives. This matches the wording of the question directly. Physical security testing guidance also describes security system performance testing as determining whether security equipment is functional, has adequate sensitivity, and meets design and performance objectives under operating conditions.

The other options are not the best answer:

A. Factory acceptance testing is normally conducted before delivery or installation to verify equipment at the factory or vendor stage.

B. Reliability performance testing focuses more on dependability, availability, or continued operation over time.

D. Site acceptance testing verifies the installed system at the actual site, but the wording about functionality, sensitivity, and design/performance objectives specifically describes equipment performance testing.

Therefore, the correct answer is C. Equipment performance testing.

Electromechanical sensors, including magnetic reed switches and contact sensors, are the most common type used on doors and windows. They detect the opening or closing of an entry point and are widely deployed in intrusion detection systems.

A (Capacitance), C (Infrasonic), and D (Fiber optic) sensors are more specialized and not commonly used for standard door/window monitoring.

An active volumetric sensor emits energy (such as sound waves or electromagnetic fields) into a defined volume and detects changes caused by movement or presence within that space. Ultrasonic sensors are a common example:

They transmit high-frequency sound waves and measure the reflections to detect objects or intruders in a monitored area.

Infrared sensors are often passive (detecting heat) or line-of-sight, rather than volumetric.

Capacitive sensors detect changes in an electric field but are typically used for proximity or tamper detection.

Vibration sensors detect mechanical disturbances rather than volumetric intrusion.

Active volumetric sensors are widely used in intrusion detection systems for rooms, corridors, or other enclosed spaces because they monitor an entire volume rather than just a single point or surface.

Bottom of Form

Comprehensive Detailed Explanation:

The three primary and sequential functions of a Physical Protection System (PPS) are:

Detection – identifying unauthorized activity.

Delay – slowing intruder progress.

Response – intervening before asset compromise.

This layered approach ensures an opportunity to detect and intercept threats before they succeed.

A and D include " deterrence " or " prevention, " which are security goals but not primary PPS functions.

C lists valid concepts but omits the critical detection phase.

Using two geographically and physically separate cable paths ensures redundancy. If one path is damaged (e.g., due to construction, sabotage, or natural disaster), the other can maintain communication. This is a key principle in critical infrastructure protection.

A: Surveillance helps detect issues but doesn’t prevent physical interruption.

B: Wireless is useful but often less reliable and secure than wired systems.

C: Tamper-proof cables increase security but don’t address path redundancy.

Comprehensive Detailed Explanation and References

Intrusion alarms are systems specifically designed to detect unauthorized entry into a protected area while the system is active. These alarms respond when a perimeter is breached, such as through windows, doors, or motion detection. When triggered, they signal unauthorized access.

System administration training should occur after site acceptance testing (SAT), which confirms that the system performs as specified. At this point, the system is stable and ready for operational use, making it the right time to train administrators on real equipment in a functional environment.

Training before SAT (A or C) risks using incomplete systems.

D (After reliability testing) may delay training unnecessarily.

A network security policy defines the scope of security measures within an organization’s network. It sets the rules for behavior, outlines acceptable use, identifies protected resources, defines responses to security breaches, and lays out disciplinary measures for violations.

Physical security (A) focuses on tangible access control.

Forensic investigations (C) deal with post-incident evidence gathering.

Spam filtering (D) is a specific technical control, not a policy framework.

Smoldering burning is the final phase of a fire where visible flames are no longer present, but extreme heat persists. This occurs when the available fuel is nearly consumed, or oxygen is limited, creating a high-temperature environment without active flames. It poses a serious re-ignition risk.

Ignition stage (B) is the beginning of the fire.

Last stage (C) is too vague.

Incipient stage (D) refers to the early development before flames appear.

Contingency planning traditionally focuses on:

Infrastructure (A)

People (B)

Processes (C)

While reputation is a concern in broader risk management and public relations, it is not considered a direct category of contingency planning programs, which deal more with operational continuity than brand management.

An electric strike allows for remote electrical locking and unlocking while still permitting free mechanical egress from the protected (inside) side of the door. This is essential for life safety and code compliance, especially in commercial and public buildings.

A (Vertical pin) is a mechanical lock component, not an electric device.

B (Electromagnetic) locks typically require power to release and may not allow mechanical egress without integration.

D (Delayed egress) restricts exit temporarily, which may violate free egress rules depending on application.

A Request for Proposal (RFP) is the most commonly used procurement method in the security industry, especially for complex systems where the buyer seeks not just price but also technical solutions, methodology, qualifications, and performance commitments.

A (RFI) is used for market research.

B (Invitation to bid) is used when scope is clearly defined and price is the primary factor.

D (RFQ) is for simpler purchases, focused on price.

Conspiracy in the context of theft or fraud refers to two or more individuals collaborating—often using confusion or chaos in the environment—to execute or conceal a theft. This is especially common in employee-customer collusion or multi-person theft scenarios.

Accountability (B) reduces confusion.

Invoicing (C) is a documentation process.

Proliferation (D) means rapid increase, not relevant here.

Standoff distance refers to the space maintained between a potential explosive threat (such as a vehicle-borne improvised explosive device, or VBIED) and the target asset. Increasing standoff distance significantly reduces the impact of a blast by leveraging the inverse-square law, which governs blast pressure dissipation over distance.

A (Blast radius) is the area affected by an explosion.

B (Impact area) refers to where a blast or projectile strikes.

C (Clear zone) is used in security but does not specifically refer to bomb offset.

Capability refers to the potential of a person to commit dishonest acts, and it is considered a controllable variable in security management. The degree of control needed over a person ' s capability depends on their level of honesty. In environments with higher risks of internal threats, security systems, supervision, and checks may be increased to mitigate the risks associated with those who have both opportunity and capability.

The contingency fee in a bid package is typically set at 10% of the total project cost. This budgetary buffer accounts for unforeseen issues, changes, or risks that might arise during project execution. It is a standard practice in both construction and security system projects.

A (5%) may be insufficient.

C (15%) and D (20%) are considered excessive unless the project has high uncertainty.

An Uninterruptible Power Supply (UPS) is the best solution to immediately mitigate the risk of power loss in a computer. It provides backup power instantly upon power failure, allowing safe shutdown or continued operation for a limited period.

A (Surge protector) protects against voltage spikes but doesn’t provide backup power.

C (Emergency generator) has a startup delay and is more suitable for large systems.

D (Batteries) are components of a UPS, not a standalone mitigation.

Effective risk mitigation requires proportional countermeasures. As threats become more advanced or sophisticated, security measures must also be upgraded accordingly. If not, the residual risk must be transferred, avoided, or accepted.

A and B are incorrect because they imply static or uniform responses to dynamic threats.

C is overly narrow; system performance depends on multiple factors, not just departmental capability.

A pre-bid conference allows all prospective bidders to gain a clear and consistent understanding of the project requirements, including walkthroughs of affected facilities. This helps ensure uniformity in bid proposals and reduces ambiguity or scope misinterpretation.

A (Engineering evaluation) is internal and technical.

C (Invitation for bid) is a document, not an event.

D (Procurement meeting) is not a standard pre-bid process phase.

Bid specifications are comprehensive documents that define the project ' s scope, including equipment requirements, installation standards, and ongoing maintenance services. They are essential for ensuring that contractors and suppliers provide consistent and comparable proposals.

Needs analysis (B) identifies security requirements but does not specify equipment or service contracts.

ROI and cost-benefit analysis (A and D) evaluate financial viability but don’t document specifications.

A trapdoor (also known as a backdoor) is a hidden method used by developers or attackers to bypass normal authentication or access controls in software. However, in technical distinction, a “trapdoor” refers more to unintentional or overlooked access, while “backdoor” is often intentional. For this question, since it emphasizes “unintentional access,” trapdoor is the best fit.

Bomb (A): Refers to logic bombs—malicious code triggered by specific conditions.

Backdoor (C): Usually intentionally left in place by developers or attackers.

Trojan Horse (D): Malware disguised as legitimate software.

After activating a crisis management team due to a major disruptive event like a hurricane, the first step in the business continuity process is to assess the damage. This step determines the severity of the situation and informs decisions about continuity of operations, safety of personnel, and resource allocation.

Stakeholder communication (B) and media response (D) follow later.

Alternate work site activation (C) may be necessary but only after damage is assessed and site safety is determined.

Conversion is a civil tort that occurs when one party wrongfully possesses or interferes with another’s personal property (chattel) to the extent that the owner ' s use or rights are seriously restricted or denied. It’s essentially a civil version of theft.

Restriction (A), Transfer (B), and Constraint (C) are not legally specific terms for this tort.

The correct answer is C. 328 ft. (100 m).

In PSP physical security system design, cabling distance is important because electronic security systems such as access control, video surveillance, and intrusion detection depend on proper communication infrastructure. The ASIS PSP Body of Knowledge includes electronic security systems, applicable codes/standards, performance requirements, and technical system design capacities under physical security system design.

For category-rated UTP cable, the standard distance limitation is 100 meters, which equals approximately 328 feet. This is the commonly accepted maximum channel distance for category-rated twisted-pair Ethernet cabling. TIA/EIA cabling references repeatedly use 100 m (328 ft) as the standard measurement length for category-rated cable performance values.

Therefore, the correct PSP-relevant answer is C. 328 ft. (100 m).

A study by BDP International found that 35 percent of shippers were accounting for additional time to comply with the Advanced Manifest System (AMS), a U.S. Department of Homeland Security requirement that came into effect in February 2003. AMS mandates that import manifest information must be submitted at least 24 hours before the cargo is loaded onto U.S.-bound vessels at foreign ports.

Line executives are individuals in the direct chain of command who are responsible for achieving the core objectives of an organization. They have authority over subordinate personnel and direct responsibility for organizational results. They differ from staff personnel, who provide advice or support but do not directly manage line functions.

Management (A) is a broader term that includes both line and staff.

Authorized directives (B) are formal instructions, not people.

Stockholders (D) are owners, not organizational authorities.

Comparative fault, also known as comparative negligence, is a legal principle where the plaintiff’s own actions are taken into account when determining liability and awarding damages. If a person contributed to their own injury—e.g., by entering a restricted area—their compensation may be reduced proportionally to their share of fault.

Control tactics (A) and Defensive control (C) relate to use-of-force procedures, not legal doctrines.

Arrest refers to the legal act of taking a person into custody. One of the essential legal requirements following an arrest is that the individual must be handed over to law enforcement or judicial authorities without unreasonable delay. This is to protect the constitutional rights of the detainee and avoid unlawful detention.

Detain (B) and Detention (C) refer to temporary restraint without full arrest.

Threatening loss (D) is unrelated.

The Salami Technique is a type of computer or financial fraud where small amounts of money are siphoned off from many transactions or accounts. These amounts are often so minor that they go unnoticed individually but accumulate into significant sums when aggregated. It’s often associated with insider fraud and manipulation of accounting or financial systems.

Manipulation technique (A) is a general term.

Auction planning (B) and Hostile applets (D) are unrelated concepts.

Software piracy is the unauthorized copying, distribution, or use of copyrighted software. This includes reselling or giving away licensed programs without proper authorization from the copyright holder.

Identity theft (A) involves stealing personal information.

War driving (B) is about locating open Wi-Fi networks.

Unauthorized access to software (C) is related but not specific to copying and distribution.

Trespass is the unauthorized physical intrusion onto someone else ' s property, or the refusal to leave after authorization has been withdrawn. It is a civil tort and can also carry criminal consequences if associated with damage or criminal intent.

Prosecution (A) relates to criminal legal action.

Verdict (C) is the outcome of a legal proceeding.

“None of the above” (D) is incorrect because Trespass is the correct legal term.

An organization should not choose a contract security provider based only on the lowest bid because low pricing often leads to reduced wages, fewer benefits, and limited training for security officers. In Human Resource management, compensation and employee support are directly connected to service quality, motivation, retention, and job performance. When wages are cut to win a bid, security firms may struggle to attract qualified personnel or keep experienced officers, which can weaken professionalism and reliability. Poor pay may also increase absenteeism, dissatisfaction, and turnover, all of which negatively affect security operations. The main concern is not simply contract length or administrative cost, but the decline in officer quality caused by underpricing. Therefore, option C is the correct answer because it best explains why relying only on the lowest bid can damage service effectiveness.

In physical security, the term " perimeter " refers to the outer boundary of a property or facility. This includes fences, walls, gates, and other barriers that mark the edge of the secured area. In contexts where yard space and warehousing are used (such as in industrial or urban logistics operations), the perimeter defines the boundary of company-owned property and is critical for physical access control.

“Fence” (A) and “Wall” (B) are types of perimeter barriers.

“Chain link” (D) is a material used in fences, not a boundary in itself.

Perimeter protection is addressed in Domain 2: Application, Design, and Integration of Physical Security Measures.

???? References:

ASIS International, Physical Security Principles (PSP) Study Guide – Domain 2

Protection of Assets (POA) Manual – Chapter: Perimeter Security

ASIS Glossary of Security Terms

Special-use alarms are tailored to monitor specific environmental or operational conditions. They include sensors and devices that detect temperature thresholds, toxic gas presence, machine vibrations, or over-speed conditions in mechanical systems. These alarms are critical in industrial and hazardous environments.

Business continuity involves two core stages:

Business Recovery – restoring critical business functions quickly after a disruption.

Business Resumption – full restoration of all business operations to normal levels over the long term.

This sequence ensures operational stability in the short term and complete restoration in the long term.

Line supervision is a critical security feature used to monitor the integrity of wiring between sensors and the alarm processor. When multiple interior sensors are connected, supervision must exist between the processor and each individual detection sensor to ensure that any tampering, disconnection, or fault is immediately identified. This approach enhances reliability and accountability within the system. In Human Resource and organizational security management, reliable detection systems are essential for protecting employees, assets, and facilities. If supervision were only applied to groups or loops, a failure at one sensor might go unnoticed, creating a security gap. Individual supervision ensures precise fault identification and faster response, supporting effective incident management and maintaining workplace safety. Therefore, option B is correct because it ensures maximum system integrity and performance.

Usenet is a global distributed discussion system that predates modern forums and social media. It operates through a network of servers and allows users to post and read messages (articles) in organized newsgroups. It ' s one of the oldest forms of online community interaction.

Telnet (B) is a protocol for remote login.

Widespread net (C) and Web net (D) are not recognized technical terms.

Comprehensive Detailed Explanation:

To implement effective preventive maintenance, you must have access to the manufacturer ' s specifications for each component. These specifications provide details such as recommended maintenance intervals, acceptable tolerances, environmental operating conditions, and part replacement guidelines.

A (MTBF), B (Performance reports), and C (Failure rates) are useful for analysis, but the foundational document for preventive action is the manufacturer’s specification.

Stakeholders are individuals or groups that either impact or are impacted by an organization’s operations, assets, or personnel. This includes internal (e.g., employees, executives) and external (e.g., customers, regulators) parties. In physical security assessments, involving stakeholders is essential to understand operational needs, identify vulnerabilities, and ensure system effectiveness.

A (Investors), B (Executives), and C (Customers) are all stakeholders but represent narrower roles.

Targeting refers to the process by which a threat actor selects a specific facility or asset based on attractiveness, vulnerabilities, symbolic value, or opportunity. This helps differentiate why one location may be more likely to be attacked than another.

Motivation (B) refers to the reason behind the attack.

Collusion (C) involves cooperation between insiders.

Desire (D) is a psychological element, not an operational step.

Asset value in risk management is determined by considering criticality, ease of replacement, and some measure of value. Criticality refers to how important the asset is to organizational operations, including its impact on productivity, safety, and continuity. Ease of replacement evaluates how quickly and easily the asset can be restored or substituted if lost. The measure of value includes financial worth as well as operational or strategic importance. In Human Resource and organizational contexts, this is especially relevant when assessing both physical assets and human capital, as employee roles and skills may be difficult to replace and highly critical to operations. Original cost alone does not reflect true importance, making it less useful. Therefore, option D is correct because it includes the most relevant and comprehensive factors for determining asset value.

The cost-of-loss formula [K = (Cp + Ct + Cr + Ci) – I] represents:

Cp: Cost of permanent replacement

Ct: Cost of temporary substitute

Cr: Repair costs

Ci: Lost income

I: Insurance reimbursement

These elements combine to determine the total value at risk if an asset is compromised or lost.

In the PSP framework, a project specification outlines the technical and operational requirements of a security system. The specification defines what the system must achieve rather than simply its cost or component tolerances.

Performance expectations describe the desired outcomes, functionality, reliability, and operational standards that the installed system must meet.

Testing specifications and equipment tolerances support validation but are derived from the performance requirements.

Cost is a budgetary consideration and does not determine functional or operational requirements.

By clearly specifying performance expectations, security planners ensure that the system is designed and implemented to meet operational needs, provide measurable results, and comply with organizational standards, consistent with ASIS PSP guidance.

The correct answer is C. Performance test.

In PSP physical security system implementation, testing is used to verify whether security equipment and systems meet required performance requirements and success metrics. The ASIS PSP Body of Knowledge includes performance requirements, success metrics, commissioning, final acceptance testing, and life-cycle evaluation as part of physical security system design and implementation.

A performance test determines measurable operating parameters of the system or equipment. For intrusion detection sensors, these parameters can include probability of detection, false alarm rate, nuisance alarm rate, sensitivity, detection coverage, and other measurable performance characteristics. Sandia’s physical security testing guidance also identifies NAR/FAR — nuisance alarm rate/false alarm rate and probability of sensing as key sensor performance metrics collected from test results.

The other options are not the best answer:

A. Safety test focuses on whether testing or equipment creates unsafe conditions.

B. Evaluation test is broader and is used to validate overall PPS effectiveness, not mainly to determine specific parameters like nuisance alarm rate.

D. Post-maintenance test is conducted after maintenance to confirm the system still works properly.

Therefore, the correct answer is C. Performance test.

When designing safety and security countermeasures for an existing (especially aging) facility, the first priority for a Physical Security Professional is to assess the current state of physical security. This includes evaluating doors, locks, windows, barriers, structural access points, and environmental design features.

Understanding what currently exists sets the foundation for integrating other systems like fire detection, access control, and intrusion detection.

Fire detection (A) is critical for life safety but not the first step in physical security design.

Access control (B) and intruder detection (D) are components of the overall physical security system and come after baseline evaluation.

An intangible asset is a non-physical resource that holds value for an organization, typically contributing to competitive advantage or operational capability. Examples include intellectual property, such as patents, trademarks, copyrights, and proprietary knowledge.

Land, buildings, and natural resources are tangible assets, meaning they have a physical form that can be seen and touched.

Intangible assets are critical in risk assessment because they often require specialized protection strategies, including legal safeguards, access control, and confidentiality measures.

ASIS PSP guidance highlights the need to recognize both tangible and intangible assets when conducting asset valuation and risk assessments, ensuring security measures are appropriately tailored to protect all forms of organizational value.

Risk avoidance means eliminating a threat entirely by discontinuing the activity or removing the condition that creates the risk. For example, if transporting valuable goods through a high-risk area poses too much danger, a company might choose to stop shipments through that route altogether.

References from PSP: Risk Treatment Options – ASIS POA; PSP Study Guide – Security Strategy Planning

Infrared beam sensors are typically used to detect movement across open areas and are line-of-sight devices. They are not well-suited for enclosed or small, solid objects like safes. They can be easily bypassed or may not be triggered when tampering with a safe that doesn’t break the beam.

A, B, and D are more effective around physical objects:

Capacitance can detect touch or presence.

Microwave can detect motion or disturbance.

Fiber optic cable can detect physical interaction or tampering.

Private security refers to individuals or organizations that offer security-related services for compensation. This includes both self-employed individuals (such as independent security consultants or contractors) and funded business entities (such as security companies or firms) that provide services to private clients for a fee. These services may include guarding, patrolling, risk assessments, investigations, alarm monitoring, or other protective activities.

Electronic eavesdropping involves the unauthorized interception or monitoring of digital data and communications, including tapping into communication lines. This can involve accessing private messages, data streams, or other electronic communications as they travel across networks.

War driving (B) refers to searching for unsecured Wi-Fi networks, not line tapping.

Digital beating (C) and Standard digitizing (D) are not recognized cybersecurity terms.

The Edison Electric Institute, in collaboration with the North American Electric Reliability Council (NERC) and the Department of Energy (DOE), developed security guidelines for the protection of the electrical grid. One of the primary components of these guidelines is performing a vulnerability/risk analysis to identify potential weaknesses and assess the impact of threats to the infrastructure.

While threat response and cyber scenarios are part of broader planning, vulnerability/risk analysis is a foundational element.

Emergency detection is important but not a specifically highlighted part of the referenced guidelines.

Comprehensive Detailed Explanation:

Pre-qualifying vendors ensures that only those with the necessary experience, resources, and qualifications are invited to bid on a project. This avoids wasted effort on unqualified proposals and increases the likelihood of successful project execution.

A (Code enforcement) and D (Spec compliance) happen during later review stages.

C (Financial stability) is one part of the evaluation but not the sole goal.

If stairwells are used regularly for inter-floor travel and permitted by local code, the best practice is to maintain both life safety and security. This can be done by installing approved access control devices (e.g., card readers) and two-way communication systems (intercoms) to manage access while allowing emergency use.

A (Fail-secure locks) could pose a safety risk in emergencies.

B (Unlocked doors) may violate building security policies.

C (Selective unlocking) is inconsistent and may cause confusion during emergencies.

Under the pure comparative negligence approach, a plaintiff can recover damages even if they were primarily responsible for their own injury. For example, if the plaintiff was 90% at fault, they could still recover 10% of the damages from the defendant. This model allows for partial recovery based on proportional fault, regardless of the level of the plaintiff’s responsibility.

50/50 rule and 51 percent rule prevent recovery when the plaintiff is found equally or more at fault.

A tort is a civil wrong for which a remedy may be obtained in the form of damages. It is based on the idea that individuals owe certain duties to others and can be held liable when they breach those duties, resulting in harm or injury.

Transitivity (A), Reassembly (C), and Procurement (D) are not related to civil legal liability.

Staff personnel serve in a supportive or advisory capacity to the organization’s line executives. They provide specialized knowledge, consultation, and services (e.g., legal, HR, finance) without having direct authority over operations. Their role is crucial in supporting efficient decision-making and strategic planning.

CFO (A) may be a staff officer but is a specific example.

Merchandiser (B) and Retail marketer (D) are job functions, not general categories of organizational roles.

Pre-action sprinkler systems are designed to prevent accidental water discharge. These systems include a detection component (such as smoke or heat detectors) that must activate before the water enters the pipes. They are often used in areas where water damage would be catastrophic (e.g., data centers, museums).

Discovery system (A), Exposure (B), and Post-action system (C) are not standard terms in fire suppression.

“Post-action system” is incorrect; the correct terminology is “pre-action system.”

When an organization employs contract security services, the administrative workload related to hiring, payroll, training, and scheduling shifts to the service provider. This is a significant benefit for companies looking to reduce internal administrative burdens and focus on core operations.

Proprietary (C) systems require the organization to manage all aspects of employment.

Union (A) and Security (B) are unrelated to the comparison of administrative workload between contract and proprietary services.

Threats in security risk assessments are typically classified as either man-made (e.g., vandalism, terrorism) or natural (e.g., earthquakes, floods). This distinction helps define appropriate mitigation strategies.

A, B, and C describe other possible classifications but are not the foundational categories.

Intangible assets are non-physical resources that carry value for an organization and require protection despite lacking a tangible form. Patents are a classic example because they represent proprietary technology or intellectual property, which can provide competitive advantage and legal protection.

Reputation and digital files may hold value, but in PSP asset valuation, patents are specifically recognized as legal intangible assets with quantifiable ownership rights.

Obsolete equipment is a tangible, depreciated asset and does not qualify as intangible.

Properly identifying and valuing intangible assets like patents ensures that security strategies address not only physical property but also intellectual and proprietary assets, aligning with PSP guidance on comprehensive asset protection.

Risk management is the continuous and proactive process of identifying areas where a business may suffer losses, assessing the likelihood and potential impact of those losses, and implementing security countermeasures to minimize or eliminate them. This function ensures that organizational assets—people, property, and information—are protected against threats such as theft, sabotage, natural disasters, and operational failures.

References from PSP: ASIS POA – Risk Management; PSP Study Guide – Physical Security Assessment Domain

In risk management and Human Resource contexts, assets are defined as anything that holds value to an organization, whether tangible or intangible. Tangible assets include physical items such as buildings, equipment, and technology, while intangible assets include intellectual property, employee skills, organizational reputation, and data. HR plays a critical role in protecting and developing intangible assets, particularly human capital, which is often one of the most valuable resources of an enterprise. Options A and B are too narrow because assets are not limited to fame or financial gain alone, and option C is incorrect as assets must have value. Recognizing all forms of assets helps organizations implement effective risk management, security measures, and workforce strategies. Therefore, option D correctly defines assets in a comprehensive and accurate manner.

The correct answer is A. To provide connectivity.

In a physical security system, the communications subsystem serves as the link that allows different security subsystems to exchange signals, data, alarms, and control information. It supports connectivity between devices such as access control panels, intrusion detection sensors, video surveillance systems, alarm monitoring equipment, control stations, and other integrated security components.

The other options are related but too narrow:

Coordinating surveillance operations is usually a function of the video management or command-and-control system.

Emergency communications may be supported by the broader communications infrastructure, but that is not its primary role for all security subsystems.

Secure data transmission is important, especially in modern networked systems, but the basic primary function is still to provide connectivity.

Therefore, the communications subsystem’s main purpose is to provide connectivity across all security subsystems so they can operate as an integrated security system.

Risk acceptance is the mitigation option that has no direct cost because the organization chooses to acknowledge the risk without taking additional action to reduce, transfer, or eliminate it. In Human Resource and organizational management, this approach is typically used when the cost of mitigation exceeds the potential impact of the risk or when the risk level is considered minimal. While there may still be indirect consequences if the risk materializes, no immediate financial investment is required to manage it. In contrast, risk avoidance may involve changing operations, risk limitation requires implementing controls and safeguards, and risk transference often includes costs such as insurance or outsourcing. Therefore, option B is correct because risk acceptance does not require upfront expenditure, making it the only option with no direct cost.

The correct answer is A. an unauthorized master key permits access through any lock in the series.

In PSP physical security, locks and key systems are part of structural security measures and access control countermeasures. The ASIS PSP Body of Knowledge includes locks under physical security countermeasure selection and implementation.

A master-keying system allows one master key to open multiple locks within a defined lock series. This is useful for management and emergency access, but it creates a major security risk: if the master key is lost, stolen, duplicated, or otherwise obtained by an unauthorized person, that person can access every lock controlled by that master key. Physical security lock guidance describes this as the most obvious security problem with master keys.

The other options are incorrect:

B is incorrect because master keying generally reduces the number of useful combinations, not increases them.

C relates more specifically to removable-core lock risks, not the main master-keying problem.

D is incorrect because close tolerances usually make picking harder, not easier.

Therefore, the correct answer is A.

Quantitative analysis involves the use of numeric data to evaluate system performance. In Intrusion Detection Systems, metrics such as Probability of Detection (PD), False Alarm Rate (FAR), and Nuisance Alarm Rate (NAR) are used to objectively measure system effectiveness.

A and C are more subjective or observational.

B (Theoretical) implies modeling, not actual data evaluation.

An “innocuous virus” is not a formally recognized type of computer virus. All viruses, by definition, are considered malicious because they replicate without authorization and potentially cause harm, whether immediate or latent.

Common types of viruses include:

Humorous (B): A virus designed to prank users without causing real harm (e.g., funny messages).

Hostile (C): Actively destructive or malicious.

Altering (D): Modifies system files or behaviors.

" Innocuous virus " (A) is a misnomer, making it the correct choice as " not " a virus type.

The four common types of physical lock-down systems for protecting hardware, especially in IT environments, include:

Cages: Enclosures for servers or critical equipment.

Plates: Lock-down plates secured to desks or floors.

Cables: Security cables to tether devices.

Alarms: Motion or tamper-detection systems.

These measures are used to deter theft and unauthorized physical access.

One of the primary drawbacks of using contract security services is the reduction in direct control over the personnel and operations. While contract services offer benefits such as simplified administration, quick staffing solutions, and access to specialized expertise, they limit the organization ' s ability to directly manage and discipline personnel or tailor services to company-specific policies and culture.

Administration (B), Staffing (C), and Expertise (D) are all advantages of contract services.

Control (A) is a typical advantage of proprietary systems, not contract models.

Ethernet was developed in the early 1970s by Robert Metcalfe and his team at Xerox Corporation’s Palo Alto Research Center (PARC). It became the foundational technology for local area networks (LANs) and remains widely used in networking today.

IBM (B) developed other networking technologies but not Ethernet.

Microsoft (C) is a software company and did not develop Ethernet.

The best way to express the impact of a risk in business terms is through monetary value. This allows decision-makers to understand the financial consequences of threats and justify investments in controls or mitigation strategies. Assigning a dollar value helps in prioritizing risks and performing cost-benefit analyses.

B (Cost-benefit ratio) is used in analysis, not direct impact expression.

C (Downtime estimate) is useful, but only a part of financial impact.

D (Frequency graph) represents likelihood, not impact.

Focal length is the primary factor in determining the magnification and field of view in a camera lens. A longer focal length results in a narrower field of view and greater magnification of distant objects. Conversely, a shorter focal length gives a wider field of view with less magnification.

A (Image device) and B/C (Lens or image format) influence compatibility and image quality, but do not directly affect magnification.

Proprietary security services are those in which the security personnel are hired, trained, and managed directly by the organization they protect. They are part of the company’s staff and are not outsourced from external firms. Proprietary security typically ensures tighter integration with company culture and policies and offers better control over personnel and procedures.

Contract security services (Answer D) involve third-party firms providing personnel who are not employees of the protected organization.

Security enforcement (Answer B) is a general term, not a specific classification.

Pilferage (Answer C) refers to theft and is unrelated to service type.

The multifactor approach examines terrorism through multiple dimensions, including psychological, sociological, ideological, and organizational factors. It analyzes how individuals are recruited, indoctrinated, and motivated within terrorist networks. This is key in understanding the behavioral patterns and lifecycle of a terrorist.

Exclusion areas are the most secure zones within a controlled facility, designed specifically for handling or storing high-value, classified, or critical assets. These areas have strict access controls, surveillance, and protective measures in place to prevent unauthorized access or theft.

Limited areas (A) offer less stringent protection than exclusion areas.

Multiple areas (C) is a non-standard term.

“None of the above” (D) is incorrect because exclusion areas is the correct answer.

The actions described represent risk reduction because the organization is implementing measures to decrease the likelihood and impact of theft rather than eliminating the activity entirely. Moving the coat department, installing surveillance systems, using anti-theft tags, and limiting access to merchandise are all strategies that reduce vulnerability and deter potential offenders. In Human Resource and organizational management, risk reduction is a common approach that balances operational needs with security controls, allowing business activities to continue while minimizing threats. Risk avoidance would involve eliminating the activity altogether, such as no longer selling coats, while risk transfer would involve shifting responsibility, such as through insurance. Risk acceptance would mean taking no action. Therefore, option B is correct because the organization is actively reducing exposure to theft through multiple preventive measures.

A suicide attack is a tactic where the attacker intentionally sacrifices their life to ensure the success of the mission. This is seen in tactics such as suicide bombings or vehicle-borne IEDs. It is used to maximize impact, instill fear, and often guarantees media attention.

Risk assessment is a foundational step within the risk management process—not an alternative to managing risk. Alternatives to optimize risk management include:

Risk avoidance: eliminating the activity causing the risk

Risk transfer: shifting the risk to another party (e.g., through insurance)

Risk spreading: distributing the risk to reduce overall impact

Risk assessment, in contrast, is the evaluation of threats and vulnerabilities and precedes these treatment decisions.

References from PSP: Risk Treatment Options – ASIS POA; PSP Study Guide – Risk Management and Analysis

Within the PSP framework and project management methodology, the design phase is where technical and cost evaluations are conducted. During this phase, the security system’s requirements are translated into detailed specifications, including system architecture, component selection, and preliminary layouts.

Technical evaluation assesses whether proposed systems, devices, or configurations meet operational and functional requirements, including performance, scalability, and compliance with standards.

Cost evaluation ensures that proposed solutions align with the organization’s budget and provides a basis for cost-benefit analysis.

These evaluations inform decision-making before procurement and installation, reducing risk of over-specification, underperformance, or budget overruns. In contrast, planning defines objectives and scope, procurement executes purchase decisions, and installation implements the system according to the design.

For confined interior areas containing explosive vapors or materials, non-emitting sensors are preferred to avoid ignition risk. Passive Infrared (PIR) sensors are ideal in such environments because they detect heat signatures (infrared energy) emitted by intruders without emitting any signals or energy that could trigger an explosion.

A (Ultrasonic) and C (Capacitance) sensors emit signals.

D (Passive vibration sensors) detect vibration and are used in a different context, like surface tampering.

Security is not a standalone function; it must align with and support the broader mission and strategic goals of the organization. This includes protecting assets, enabling business continuity, and ensuring safety in a way that complements business objectives.

A (Quarterly cycle) is not a standard requirement.

B (Certified manager) is good practice but not a defining mandate.

D (Lowest cost) is not always ideal; effectiveness and alignment are more important than minimal cost.

Capacitance proximity sensors detect changes in electrical capacitance, which can be influenced by environmental conditions. Changes in relative humidity can affect the dielectric properties of the air or materials nearby, potentially causing false alarms or degraded performance.

B (Temperature) and C (Air movement) typically affect other sensor types (e.g., infrared or ultrasonic).

D (End-of-line resistance) applies to alarm circuit supervision, not proximity sensing.

An initial threat or hazard evaluation must include an assessment of how likely each threat is to occur. This probability, when combined with impact analysis, forms the foundation for risk assessments. Understanding likelihood allows prioritization of mitigation strategies.

A (Estimate costs) and C (Develop business case) are later steps.

D (Develop response plan) comes after risk characterization.

Training plays a critical role in enhancing employee motivation, which directly contributes to higher employee morale. In Human Resource management, well-designed training programs improve employees’ skills, confidence, and sense of value within the organization. When employees feel competent and supported, their job satisfaction increases, leading to a more positive attitude toward their work and the organization. This improved morale often results in better teamwork, reduced turnover, and increased productivity. Training does not inherently increase workload or supervision, nor is legal protection its primary outcome. Instead, it strengthens employee engagement and commitment. Therefore, the most accurate outcome of improved staff motivation through training is enhanced employee morale, making option D the correct answer.

The primary function of an electronic security system during an attempted or successful penetration is to notify personnel so that appropriate action can be taken. While alarms, countermeasures, and system integrations are important components, they are all secondary to ensuring that responsible individuals are informed promptly. In Human Resource and organizational security management, timely notification enables trained personnel to respond effectively, follow established procedures, and minimize potential damage or risk. Without proper notification, alarms alone may not lead to action, and automated responses may not address the situation appropriately. Effective communication and response coordination are critical aspects of workplace safety and incident management. Therefore, notifying personnel is the most essential function, making option B the correct answer.

Comprehensive Detailed Explanation:

Specifications are considered the cornerstone of any construction project because they define the materials, workmanship, quality standards, and installation requirements. They ensure consistency, compliance with design intent, and are the foundation upon which contractors bid and work.

A (Drawings) show layout but don’t specify materials or quality.

B (Guidelines) are general and not enforceable.

C (Procedures) guide execution but are not foundational to the build.

A bidder instruction document typically requests verification of a contractor ' s relevant experience and professional licenses. This ensures the vendor is qualified and legally authorized to perform the work.

A, C, and D include valid components but do not reflect the standard combination used for qualification.

Integrity, in the context of information security, refers to ensuring data is accurate, consistent, and unaltered by unauthorized actions. Maintaining integrity prevents data manipulation or corruption, ensuring reliability for organizational decision-making.

Analysis (A) is the process of evaluating data.

Security (C) is a broader term encompassing integrity, confidentiality, and availability.

Availability (D) ensures access but does not guard against data tampering.

Project management principles emphasize balancing scope, time, and cost, often referred to as the project management “triple constraint” or “iron triangle.”

Scope defines the work required to complete the project successfully, including deliverables, system specifications, and operational objectives.

Time represents the project schedule and deadlines for completing tasks, phases, or milestones.

Cost encompasses budgetary limits, including labor, materials, equipment, and contingencies.

A project manager must continuously monitor and adjust these factors to ensure that changes in one area do not negatively impact the others. For example, expanding scope without adjusting time or cost can jeopardize project success. This approach aligns with PSP guidance for security system projects, where maintaining balance among scope, schedule, and budget is critical to delivering an effective and operationally viable security system.

Insurance should be viewed as a complementary component of a security program, not a replacement. It provides financial recovery after a loss has occurred but does not prevent the loss itself. Security operations—including physical barriers, surveillance, policies, and personnel—serve as the primary defense against threats. Insurance mitigates the financial impact only after an incident.

Establishing performance requirements improves a security program because it helps decision-makers choose security features that directly support the organization’s overall protection strategy. In management and Human Resource related planning, clear performance requirements guide the selection of tools, procedures, and personnel responsibilities based on how well they achieve desired outcomes rather than simply meeting a checklist. This approach ensures that resources are aligned with actual risks, operational goals, and employee safety needs. It also supports better training, accountability, and coordination across departments because everyone understands what level of performance is expected. Validating compliance or certification may be useful later, but those actions do not primarily increase program effectiveness during design. The greatest benefit comes from choosing features that strengthen the full strategy. Therefore, option B is the most accurate answer.

One of the key indicators of effective management is the ability to delegate responsibilities. Delegation allows managers to focus on strategic oversight rather than becoming bogged down in tasks that can be handled at lower levels. This empowers staff, improves efficiency, and enhances organizational agility.

Managers who fail to delegate often become bottlenecks, negatively impacting team performance.

Security awareness training ensures that all employees understand security policies, recognize threats, and know how to respond appropriately. It is critical for creating a proactive security culture and ensuring that all layers of defense—including human factors—are effective.

A, B, and D refer to specific training content areas, but security awareness encompasses overall employee engagement and is critical for program success.

Comprehensive Detailed Explanation:

One of the key principles of good security reporting is objectivity, not subjectivity. Reports should be clear, concise, timely, and objective to ensure factual, actionable information. Subjectivity introduces bias and undermines the reliability of reports.

A (Clarity), B (Timeliness), and D (Conciseness) are all core principles of effective reporting.

In the context of physical security, predictability typically refers to human behavior patterns that adversaries could exploit. For example, predictable patrol schedules or access procedures can be observed and defeated. Reducing predictability enhances security by complicating an attacker’s planning process.

A (Accuracy) and B (Effectiveness) relate to system performance.

D (Efficiency) relates to resource use, not vulnerability.

Site acceptance testing is the best choice because it verifies that the completed security system, once installed at the client’s location, meets the physical and functional requirements stated in the contract. This form of testing confirms that the system performs properly in the actual operating environment, where real conditions such as layout, user interaction, workflows, and site-specific risks can affect performance. In organizational and Human Resource related operations, this is important because employees, supervisors, and security personnel must rely on systems that function correctly in daily practice, not only in theory or in a factory setting. Factory testing may confirm equipment quality before delivery, but it does not fully prove contract compliance after installation. Therefore, site acceptance testing provides the most reliable demonstration to the client that all specified requirements have been met.

The most widely accepted classification of leadership skills includes:

Conceptual skills: Ability to think abstractly and see the " big picture "

Human relations skills: Interpersonal and communication capabilities

Technical skills: Expertise and proficiency in specific tasks

These skill sets are collectively known as the " skill mix " and are essential for effective security leadership.

A hybrid staffing model uses both proprietary and contract security personnel. In this scenario:

Proprietary staff can be assigned to sensitive and top-secret projects for tighter control, loyalty, and internal vetting.

Contract staff can manage less critical areas such as visitor parking, reducing cost.

This model is both secure and cost-effective, offering flexibility and risk-based deployment.

B (Contract) is cost-effective but lacks control for sensitive tasks.

C (Proprietary) is highly secure but more expensive.

D (Total systems) is not a staffing strategy.

Comprehensive Detailed Explanation:

Contingency planning in security and business continuity comprises four key components:

Emergency Response – immediate action to protect life and assets.

Crisis Management – command, communication, and decision-making during crises.

Business Recovery – restoring critical functions temporarily.

Business Resumption – restoring full, normal operations post-disruption.

Other options include irrelevant terms such as “pressure devices” or “under investigation,” which are not core to contingency planning.

The correct answer is D. retinal pattern recognition.

In PSP physical security design, access control is part of integrated physical security systems and countermeasure implementation. ASIS describes the PSP credential as covering physical security assessments, integrated physical security systems, and implementation/evaluation of security measures.

Retinal pattern recognition is a biometric access control method. It verifies a person based on a unique physical characteristic rather than something the person carries or knows. Biometric authentication uses unique body characteristics such as retinas, fingerprints, facial structure, or other biological traits for security and authentication.

The other options provide lower security by comparison:

A. Proximity card — possession-based credential; it can be lost, stolen, shared, or cloned.

B. Computer-controlled keypad — knowledge-based credential; PINs can be observed, guessed, shared, or compromised.

C. Smart card — stronger than a basic proximity card, but still a possession-based credential unless combined with PIN or biometric verification.

D. Retinal pattern recognition — biometric; tied directly to the individual and therefore provides the highest level of security among the listed options.

Therefore, for a high-security area such as a data center, the best answer is D. retinal pattern recognition.

Infrared sensors can function as both passive and active types:

Passive Infrared (PIR): Detects natural heat (infrared radiation) from people or animals.

Active Infrared: Emits infrared beams and detects interruptions in the beam (e.g., photoelectric sensors).

This dual use allows infrared to serve a variety of security applications.

A (Microwave) is strictly active.

C (Vibration) and D (Pressure) are passive only.

The description in the question refers to a " qualified " or " trained " individual in security or loss prevention, but none of the answer choices—Engaged liaison, Review personnel, Supportive person—specifically identify a person already knowledgeable in loss prevention and security. Therefore, “None of the above” is the correct choice as it best fits the context.

Engaged liaison (A) refers to someone facilitating coordination, not necessarily with security knowledge.

Review personnel (B) and Supportive person (C) are too generic and do not accurately define a trained security professional.

Comprehensive Detailed Explanation:

Pandemics primarily impact human health and workforce availability rather than directly damaging physical infrastructure. The effects on infrastructure are typically secondary, such as reduced staffing at utilities or service providers, rather than structural destruction (as in natural disasters).

Infrastructure remains physically intact, but operations may be disrupted due to workforce shortages.

Nuisance alarms, particularly from doors, are often caused by mechanical failures such as worn hinges, faulty magnetic switches, or misaligned contacts. Regular inspections and maintenance are the most effective way to reduce false alarms.

Signage (A) helps inform but doesn’t fix the mechanical issue.

Patrols (C) are reactive, not preventative.

Janitorial scheduling (D) can reduce traffic but doesn’t address faulty hardware.

Wide Area Networks (WANs), like LANs, allow multiple devices to share communication lines. In WANs, technologies such as packet switching, virtual circuits, and multiplexing are used to let multiple users communicate over shared infrastructure. This is essential for scalability and efficiency across geographically dispersed locations.